My External IP Lists (BYOIPB)
External IP Lists let you bring third-party blocklist URLs into ELLIO. ELLIO downloads them on a schedule, normalises them, and makes them available as sources you can include or exclude in any EDL Deployment.
Manage them at platform.ellio.tech/dashboard/byoipb.
Technical preview. The product label this page reaches for is "Bring Your Own IP Blocklist" (BYOIPB). The data shape is stable; the UI may evolve.
When to use this
- A vendor publishes a feed (e.g. abuse.ch, Spamhaus DROP, internal SIEM lookup, partner list) you want to act on alongside ELLIO data.
- An internal team maintains a YAML/CSV/text list in a Git repo or S3 bucket and you want it to flow into firewall enforcement automatically.
- You want to A/B-test a community list before deciding whether to make it permanent.
Adding a source
The form at /dashboard/byoipb/create has three sections:
1. Basic information
| Field | Required | Notes |
|---|---|---|
| Blocklist Name | Yes | Used everywhere the source is referenced. |
| Blocklist URL | Yes | Direct URL to a text file with one IP/CIDR per line. |
| Verify SSL Certificate | Toggle | On by default. Disable only if you trust the source and need to bypass certificate issues. |
| Description | No | Free-text. Helpful for teammates. |
The URL must return a plain text body. Lines that start with # or // are
treated as comments and ignored. IPv4, IPv6, and CIDR notation are all
supported. IPv6 addresses are normalised to /64 blocks.
2. Authentication (optional)
If the source requires authentication, configure it here. The default is No Authentication for publicly accessible URLs.
3. Download Schedule
| Field | Notes |
|---|---|
| Update Frequency | How often ELLIO checks the URL for changes. Some frequencies require workspace verification. |
| Enable Automatic Downloads | Toggle. Downloads run automatically on the configured schedule. Disable to pause without deleting the source. |
A Verify Workspace button at the top of the BYOIPB list page kicks off
verification when needed.
How the data flows
- ELLIO downloads the URL on the configured cadence.
- Each downloaded snapshot is parsed and normalised.
- The normalised list is exposed under My External IP Lists in the EDL Deployment source picker.
- Active EDL Deployments that include the source pick up the new content on their own update frequency.
End-to-end propagation: BYOIPB cadence → EDL update frequency → firewall fetch cadence. Plan for the longest of the three when reasoning about how fresh your enforcement is.
Format expectations
A BYOIPB-compatible file looks like this:
# Comments starting with # are ignored
// As are comments starting with //
203.0.113.42
198.51.100.0/24
2001:db8::1
2001:db8::/32
ELLIO accepts files of any size, but very large feeds may be subject to plan-level limits. Contact Support if you need to ingest something in the millions of entries.
Empty-list safety
If a BYOIPB fetch returns an empty file (or fails), ELLIO keeps the previous snapshot active to prevent inadvertently removing protections from your EDL. Failed fetches are visible on the source detail page with the failure reason.
Removing a source
Deletion removes the source from BYOIPB and detaches it from any EDL Deployments that included it. The deployments themselves continue to operate with their other sources.